Recovery Scams: The Second Scam After a Scam

If someone contacted you first and offered to get your money back, treat it as a scam. The rule has three parts and it holds across every version of this: a legitimate service does not cold-contact you, does not ask for an upfront fee, and does not need remote access to your device or your accounts. Government agencies do not charge victims to investigate crimes, and no one, including this page, can promise that money will be recovered. The free official routes are listed further down, and they are the same routes whether or not you were approached.

The one-line test, and why it is enough

You do not need to evaluate the offer, the credentials, the website, or the case number they quote. You need to answer one question: who made contact first?

Almost every recovery scam begins with an inbound approach, because that is the only way the business model works. The people running it hold a list of previous victims and the offer has to reach them. A real lawyer you hired, a real bank fraud team you called, a real government portal you typed into a browser: in each case you initiated the contact through a channel you found yourself. If the conversation started with a message, a call, a social media reply or a comment under a post about losing money, the answer is already available regardless of what follows.

This is the same underlying structure as the advance-fee pattern described in advance-fee scams: a payment now to release a larger amount later. Recovery scams are that trick aimed at people whose defenses were already broken once.

Why they knew about your loss, and why that is the tell

The detail that convinces most people is that the caller already knows what happened. They know roughly how much you lost, which platform it happened on, sometimes the date. That feels like proof of legitimacy and it is the exact opposite.

The Federal Trade Commission states it plainly in its consumer advice on refund and recovery scams: scammers buy lists of people who have already paid scammers, and those lists include the person's name, address, phone number, the kind of scam involved, and how much money they paid. The knowledge is purchased, not investigated. The FTC has continued to publish warnings on this pattern, including a consumer alert in August 2026 aimed specifically at people who have already lost money to a scam.

So the sentence to keep is this: accurate details about your loss are evidence that you are on a list, not evidence that the caller is real. Once you know the list exists, the second wave stops feeling like a coincidence and starts looking like what it is, a follow-on sale to a known buyer.

What the impersonation looks like now

Two forms are documented well enough to name specifically, both by the FBI's Internet Crime Complaint Center.

Fictitious law firms. In a public service announcement issued in June 2024, IC3 described fraudsters posing as lawyers from invented law firms who contact cryptocurrency scam victims through social media and messaging platforms, claim authorization to investigate fund recovery, and validate themselves by saying they are working with the FBI, the Consumer Financial Protection Bureau, or another government agency. IC3 reported that victims further exploited this way lost more than $9.9 million between February 2023 and February 2024, and issued a follow-up announcement in August 2025 describing the same scheme with additional tactics. IC3's own advice is direct: do not release financial or personal information, do not send money, and note that law enforcement does not charge victims a fee for investigating crimes.

Impersonation of the reporting agency itself. In a public service announcement dated July 20, 2026, IC3 warned that criminals are impersonating FBI personnel and IC3 to persuade previous victims to hand over more money and information. The tactics named include fake social media profiles presented as FBI agents, spoofed websites built to mimic the real IC3 site, caller ID spoofing, and AI-generated deepfake video of senior FBI officials used in live video calls. Two points from that announcement are worth memorizing: IC3 does not maintain a social media presence and does not solicit contact through social media, phone or email, and you should type www.ic3.gov directly into your browser rather than reaching it through a search result.

What a legitimate route actually looks like

Notice that none of these rows require you to judge whether a company is real. Each one is a structural test that a genuine service passes automatically.

Where to report, for free

These are the routes that cost nothing. Use them directly rather than through anyone who contacts you.

• Your bank, card issuer, or the payment provider you used. Call the number printed on your card or statement. They are the only party who can act on the transaction itself, and speed matters.
• The FTC at reportfraud.ftc.gov for general consumer fraud in the US. Reports feed the Consumer Sentinel Network used by law enforcement agencies.
• The FBI's IC3 at ic3.gov for internet-facilitated crime, typed directly into the browser, per IC3's own guidance.
• IdentityTheft.gov if personal identity documents or numbers were exposed.
• Your state attorney general's consumer protection office, which handles consumer complaints at state level in the US and can act on businesses operating there.
• Outside the US: Action Fraud in the UK, the Canadian Anti-Fraud Centre in Canada, Scamwatch in Australia. Our guide on how to report financial fraud covers how to find the right body where you live, and our report financial fraud page lists these channels in one place.

We do not name, recommend, or link to any private recovery company, and we would suggest treating any article that does with caution. FinMateMastery is not an authority and cannot recover your money.

What nobody can honestly promise you

This is the part that makes recovery offers so effective, so it is worth stating without softening. Whether money can be returned depends mostly on the payment method used and how quickly the institutions were told. Card payments have dispute and chargeback routes. Bank transfers you authorized yourself are harder, and rules differ sharply by country. Cryptocurrency and wire transfers are the hardest cases, and tracing funds on a public blockchain is not the same thing as getting them back, since tracing shows where value moved while recovery requires an institution with legal authority to freeze or return it. Our guide on what recovery actually looks like sets out the realistic picture by payment rail.

A genuine professional in this area describes probabilities and prerequisites, charges through a regulated engagement you initiated, and tells you when the answer is likely no. Certainty is the marketing of a fraud.

If you already paid a recovery service

You are not the first, and this is a recognized pattern rather than a personal failure. Practical next steps, in order:

1. Stop all contact. Do not send a further payment to release the first one, which is the standard escalation.
2. Call your bank or card issuer immediately using the number on your card, and ask whether the payment can be stopped, recalled or disputed. Timing is the variable you can still influence.
3. Revoke any access you granted. If you installed screen-sharing or remote-control software, disconnect the device from the internet, uninstall it, and change passwords from a different device, starting with your email.
4. Report both events, the original scam and the recovery scam, through the official routes above. They are separate offenses and both are worth recording.
5. Preserve everything. Messages, phone numbers, payment references, website addresses, and a written timeline with dates.
6. Expect a third approach. Paying once marks you as responsive on a list that gets resold.

Consider telling one person you trust. Isolation is part of how the second scam works, and the FBI has specifically noted that these schemes exploit the victim's emotional state and financial need.

A note on how to use this

This page cites the FTC's consumer advice on refund and recovery scams, IC3 public service announcements from June 2024, August 2025 and July 2026, and the reporting channels those agencies publish, as checked in August 2026. It is general information and not legal or financial advice. FinMateMastery is not an authority, is not affiliated with any agency named here, and cannot recover your money or assess your case. Rules and reporting bodies differ by country, and agency guidance is updated over time, so check the agency's own site directly. Please also read our full Disclaimer.

Frequently asked questions

Are all money recovery services scams?
Legitimate regulated professionals do exist, including lawyers, and banks themselves pursue recoveries as part of a dispute. What does not exist is a legitimate service that finds you first, charges a fee up front, needs remote access to your device, or guarantees an outcome. Judge the structure of the approach rather than the credibility of the claims.

A caller said they were from a government agency about my case. How do I check?
End the call, then contact the agency yourself through an address you type in directly. IC3 states that it does not maintain a social media presence and does not solicit contact by social media, phone or email, and law enforcement does not charge victims a fee for investigating crimes. An unsolicited contact claiming otherwise answers its own question.

They already know exactly how much I lost. Doesn't that prove they are real?
No, and it is closer to proof of the opposite. The FTC states that scammers buy lists of people who have already paid scammers, containing contact details, the type of scam, and the amount paid. Accurate details show you are on a purchased list.

Is it worth reporting if my money is probably gone?
Yes. Reports feed the databases law enforcement uses to identify patterns and operators, they create a record you may need for your bank or your taxes, and they can trigger action on payment channels that no individual can reach. Reporting is free through the official routes listed above.

What should I do first if I was contacted today?
Do not reply, do not pay, and do not install anything. Then contact your own bank on the number on your card and report through the official channel for your country. If you have already paid, follow the six steps above, starting with stopping contact and calling your bank.

Aron Benjamin